Commit 9479a058 authored Aug 02, 2019 by Guenter Roeck Committed by Greg Kroah-Hartman Aug 16, 2019

usb: typec: tcpm: Ignore unsupported/unknown alternate mode requests



commit 88d02c9ba2e83fc22d37ccb1f11c62ea6fc9ae50 upstream.

TCPM may receive PD messages associated with unknown or unsupported
alternate modes. If that happens, calls to typec_match_altmode()
will return NULL. The tcpm code does not currently take this into
account. This results in crashes.

Unable to handle kernel NULL pointer dereference at virtual address 000001f0
pgd = 41dad9a1
[000001f0] *pgd=00000000
Internal error: Oops: 5 [#1] THUMB2
Modules linked in: tcpci tcpm
CPU: 0 PID: 2338 Comm: kworker/u2:0 Not tainted 5.1.18-sama5-armv7-r2 #6
Hardware name: Atmel SAMA5
Workqueue: 2-0050 tcpm_pd_rx_handler [tcpm]
PC is at typec_altmode_attention+0x0/0x14
LR is at tcpm_pd_rx_handler+0xa3b/0xda0 [tcpm]
...
[<c03fbee8>] (typec_altmode_attention) from [<bf8030fb>]
				(tcpm_pd_rx_handler+0xa3b/0xda0 [tcpm])
[<bf8030fb>] (tcpm_pd_rx_handler [tcpm]) from [<c012082b>]
				(process_one_work+0x123/0x2a8)
[<c012082b>] (process_one_work) from [<c0120a6d>]
				(worker_thread+0xbd/0x3b0)
[<c0120a6d>] (worker_thread) from [<c012431f>] (kthread+0xcf/0xf4)
[<c012431f>] (kthread) from [<c01010f9>] (ret_from_fork+0x11/0x38)

Ignore PD messages if the associated alternate mode is not supported.

Fixes: e9576fe8 ("usb: typec: tcpm: Support for Alternate Modes")
Cc: stable <stable@vger.kernel.org>
Reported-by: Douglas Gilbert <dgilbert@interlog.com>
Cc: Douglas Gilbert <dgilbert@interlog.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Tested-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/1564761822-13984-1-git-send-email-linux@roeck-us.net


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 3f524b63

drivers/usb/typec/tcpm.c

+24 −14

Original line number	Diff line number	Diff line
		@@ -1108,6 +1108,7 @@ static int tcpm_pd_svdm(struct tcpm_port port, const __le32 payload, int cnt,
		break;
		case CMD_ATTENTION:
		/* Attention command does not have response */
		if (adev)
		typec_altmode_attention(adev, p[1]);
		return 0;
		default:
		@@ -1160,20 +1161,26 @@ static int tcpm_pd_svdm(struct tcpm_port port, const __le32 payload, int cnt,
		}
		break;
		case CMD_ENTER_MODE:
		if (adev && pdev) {
		typec_altmode_update_active(pdev, true);

		if (typec_altmode_vdm(adev, p[0], &p[1], cnt)) {
		response[0] = VDO(adev->svid, 1, CMD_EXIT_MODE);
		response[0] = VDO(adev->svid, 1,
		CMD_EXIT_MODE);
		response[0] \|= VDO_OPOS(adev->mode);
		return 1;
		}
		}
		return 0;
		case CMD_EXIT_MODE:
		if (adev && pdev) {
		typec_altmode_update_active(pdev, false);

		/* Back to USB Operation */
		WARN_ON(typec_altmode_notify(adev, TYPEC_STATE_USB,
		WARN_ON(typec_altmode_notify(adev,
		TYPEC_STATE_USB,
		NULL));
		}
		break;
		default:
		break;
		@@ -1183,7 +1190,9 @@ static int tcpm_pd_svdm(struct tcpm_port port, const __le32 payload, int cnt,
		switch (cmd) {
		case CMD_ENTER_MODE:
		/* Back to USB Operation */
		WARN_ON(typec_altmode_notify(adev, TYPEC_STATE_USB,
		if (adev)
		WARN_ON(typec_altmode_notify(adev,
		TYPEC_STATE_USB,
		NULL));
		break;
		default:
		@@ -1195,6 +1204,7 @@ static int tcpm_pd_svdm(struct tcpm_port port, const __le32 payload, int cnt,
		}

		/* Informing the alternate mode drivers about everything */
		if (adev)
		typec_altmode_vdm(adev, p[0], &p[1], cnt);

		return rlen;